Microsoft Security Bulletin MS15-103 - Important

Vulnerabilities in Microsoft Exchange Server Could Allow Information Disclosure (3089250)

Published: September 8, 2015

Version: 1.0

Executive Summary

This security update resolves vulnerabilities in Microsoft Exchange Server. The most severe of the vulnerabilities could allow information disclosure if Outlook Web Access (OWA) fails to properly handle web requests, and sanitize user input and email content.

This security update is rated Important for all supported editions of Microsoft Exchange Server 2013. For more information, see the Affected Software section.

The security update addresses the vulnerabilities by correcting how Microsoft Exchange OWA handles web requests and by helping to ensure that OWA properly sanitizes user input and email content. For more information about the vulnerabilities, see the Vulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3089250.

Affected Software

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Software Maximum Security Impact Aggregate Severity Rating Updates Replaced*
Microsoft Server Software
Microsoft Exchange Server 2013 Cumulative Update 8
(3087126)
Information Disclosure Important 3062157 in MS15-064
Microsoft Exchange Server 2013 Cumulative Update 9
(3087126)
Information Disclosure Important 3062157 in MS15-064
Microsoft Exchange Server 2013 Service Pack 1
(3087126)
Information Disclosure Important 3062157 in MS15-064

*The Updates Replaced column shows only the latest update in any chain of superseded updates. For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is provided on the Package Details tab).

Update FAQ

Does this update contain any additional security-related changes to functionality?
In addition to the changes that are listed for the vulnerabilities described in this bulletin, this update includes defense-in-depth updates to help improve security-related features.

Severity Ratings and Vulnerability Identifiers

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the September bulletin summary.

Vulnerability Severity Rating and Maximum Security Impact by Affected Software
Affected Software Exchange Information Disclosure Vulnerability - CVE-2015-2505 Exchange Spoofing Vulnerability - CVE-2015-2543 Exchange Spoofing Vulnerability - CVE-2015-2544 Aggregate Severity Rating
Microsoft Server Software
Microsoft Exchange Server 2013 Service Pack 1
(3087126)
Important
Information Disclosure
Not applicable Important
Spoofing
Important
Microsoft Exchange Server 2013 Cumulative Update 8
(3087126)
Important
Information Disclosure
Important
Spoofing
Important
Spoofing
Important
Microsoft Exchange Server 2013 Cumulative Update 9
(3087126)
Important
Information Disclosure
Important
Spoofing
Important
Spoofing
Important

Vulnerability Information

Exchange Information Disclosure Vulnerability - CVE-2015-2505

An information disclosure vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited the vulnerability could discover stacktrace details.

To exploit the vulnerability, an attacker would have to create a specially crafted web application request and then submit it to a web application. The security update addresses the vulnerability by correcting how Microsoft Exchange OWA handles web requests.

Microsoft received information about the vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.

Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

Multiple Exchange Spoofing Vulnerabilities

Spoofing vulnerabilities exist in Microsoft Exchange Server when OWA does not properly sanitize specially crafted email. An authenticated attacker could exploit the vulnerabilities by sending a specially crafted email to a user. An attacker could then perform HTML injection attacks on affected systems, and attempt to trick the user into disclosing sensitive information.

To exploit the vulnerabilities, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user via OWA in an attempt to convince the user to click it.

In a web-based attack scenario, an attacker could host a malicious website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the malicious website. The attacker would have to convince the user to visit the malicious website, typically by enticing the user to click a link in either an instant messenger or email message that takes the user to the attacker's malicious website, and then convince the user to interact with content on the malicious website.

The security update addresses the vulnerabilities by helping to ensure that OWA properly sanitizes email content.

The following table contains links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title CVE number Publicly disclosed Exploited
Exchange Spoofing Vulnerability CVE-2015-2543 No No
Exchange Spoofing Vulnerability CVE-2015-2544 No No

Mitigating Factors

Microsoft has not identified any mitigating factors for these vulnerabilities.

Workarounds

Microsoft has not identified any workarounds for these vulnerabilities.

Security Update Deployment

For Security Update Deployment information, see the Microsoft Knowledge Base article referenced here in the Executive Summary.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgments for more information.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (September 8, 2015): Bulletin published.

Page generated 2015-09-03 17:14Z-07:00.